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(54) Title: TELEPHONE FRAUD DETECTION AND PREVENTION 

^ (57) Abstract: A system and method for detecting and preventing a fraudulent telephone call in telecommunication system is pro- 
^ vided. First, a termining number of a first call and an originating number of a second call are received from a telecommunication 
O network. The terminating number of the first call is compared with the originating number of the second calls which are originated 
within a predetermined time period from a termination of the first call. After comparison, it is determined whether the Erst and the 
^ second calls are fraudulent telephone calls. 
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TELEPHONE FRAUD DETECTION AND PREVENTION 



The present invention relates generally to a telecommunication system and more 
particularly to a method and system for detecting and preventing a fraudulent telephone 
call based on call record data. 



In a telecommunication dependent society, fraudulent telephone calls have 
increased to the levels where they are a problem to both telephone service providers and 
legitimate customers. Fraudulent telephone call activities include calling card fraud, 
Private Branch Exchange (PBX) fraud, fraudulent call forwarding, looping, hacking, etc. 
Fraudulent telephone calls often entail the unauthorized use of telephone billing numbers 
such as originating telephone numbers, calling card numbers and credit card numbers, 
which are associated with customer billing accounts for legitimate customers. If the 
telephone service provider charges fraudulent calls to a legitimate customer, the customer 

often complains about the bill. 

Telephone service providers generally absorb the costs for these fraudulent calls in 
order to maintain good relationships with their customers. As such, telephone service 
providers have attempted to receive and prevent such fraudulent calls. In conventional 
systems, fraudulent calls have been identified by manually monitoring call record data to 
detect fraudulent calling patterns. The call record data may include an originating 
telephone number, a terminating telephone number, a billed number, the time of each call, 
etc. The conventional method of manually monitoring the call record data for detecting and 
preventing fraudulent calls is labor intensive, costly and time-consuming. In addition, 
fraudulent calling patterns can generally only be identified a substantial time after the 
occurrence of fraudulent calls in a conventional method and system for detecting 
fraudulent calls. 
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The present invention provides a method and system for automatically detecting 
and preventing a fraudulent telephone call through the review of telephone call record data. 
More particularly, the present invention provides a method and system for detecting and 
preventing call looping. In order to detect and prevent the call looping, the present 
invention detects potential fraudulent telephone call patterns by comparing the terminating 
telephone number of a first call with the originating telephone number of a second call. 
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Another object of the present invention is to provide a method and system for a real 
time detection and prevention of fraudulent telephone calls. According to the present 
invention, the terminating telephone number of a first call is compared with the originating 
telephone number of a second call which is originated within the predetermined time 
5 period from the first call. Generally, the second call is originated substantially at the same 
time as the termination of the first call. 

In accordance with one aspect of the present Invention, a method for detecting and 
preventing a fraudulent telephone call in a telecommunication system is provided. First, 
the terminating number of a first call and the originating number of a second call are 

1 0 received from a telecommunication network. The terminating number of the first call is 
compared with the originating numbers of the second calls, which are originated within a 
predetermined time period from the first call. After comparison, it is determined whether 
the first and the second calls correspond to a fraudulent telephone call looping to 
circumvent blocks set forth by the exchange carriers. 

1 5 In accordance with another aspect of the present invention, a security system for 

detecting and preventing a fraudulent telephone call is provided. The security system 
receives the terminating number of a first call and stores it in a storage element. The 
security system includes a timer which calculates a predetermined time period from the 
first call. The security system also receives the originating number of a second call which 

20 is originated within the predetermined time period set forth by the timer. The security 
system compares the terminating number of the first call with the originating number of 
the second call to determine whether or not the first and the second calls correspond to a 

fraudulent call pattern. 

The present invention can be applied to various telecommunication systems to 
25 detect telecommunication fraud. The present invention can also be applied to security 

monitoring systems to detect an unauthorized access to a target system. Furthermore, the 
present invention can be applied to a real time fraud monitoring system. As a result, the 
present invention provides an up-front automated detection method and system for 
detecting call-looping abuse. 
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An illustrative embodiment of the present invention will be described below 
relative to the following drawings. 

FIGURE 1 is a block diagram which illustrates call looping and the detection of the 
call looping according to the present invention. 
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FIGURE 2 is a block diagr am which illustrates an exemplary configuration of the 

exchange network shown in FIGURE 1 

FIGURE 3 is a block diagr am which illustrates an example of call looping to an 
international termination where the illustrative embodiment of the present invention is 
5 applied. 

FGURE 4 is an example format of call record data which is used in the illustrative 
embodiment of the present invention. 

FIGURE 5 is block diagram which illustrates a detector of call looping using a call 

origination. 

1 0 FIGURE 6 is a block diagram which illustrates an alternative detector 

configuration. 

FIGURE 7 is a block diagram which illustrates another extended embodiment of 
the present invention shown in FIGURES 5 and 6. 

FIGURE 8 is a flowchart of the steps performed in the illustrative embodiment to 

1 5 detect a fraudulent telephone call. 

FIGURE 9 is a flowchart of the steps that are performed when it is determined that 
the originating number is the same as the terminating number in step 807 of FIGURE 8. 



20 The illustrative embodiment of the present invention concerns a telephone call 

fraud detection technique that utilizes call record data, including originating telephone 
numbers, terminating telephone numbers, billed numbers and the time of the calls. In 
particular, the illustrative embodiment of the present invention provides a method and 
system for detecting and preventing call looping fraud where calls are looped to 

25 circumvent blocks set forth by exchange carriers. A call looping fraud pattern is identified 
by comparing the terminating telephone number of a first call with the originating 
telephone number of second calls that are originated within a predetermined time period 
after the first call terminates. 

The terminating telephone number of the first call and the originating telephone 

30 number of second call are retrieved from a call record database in the exchange network. 
The illustrative embodiment of the present invention also employs an exempted number 
database for storing telephone numbers which are exempted from a fraudulent call looping 
pattern. The exempted number database can be provided to prevent legitimate calls from 
being identified as fraudulent calls. The illustrative embodiment also includes a blocking 

35 mechanism such that if a call is attempted to a telephone number previously determined to 
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be a part of o fraudulent call pattern, a block is instituted to block the attempted fraudulent 
call in real time. 

As a result, the illustrative embodiment provides an effective call fraud detection 
method and system by automatically reviewing call record data to locate a fraudulent call 
5 patterns, including call looping fraud patterns. The present invention can be applied to a 
security monitoring system to detect an unauthorized access to a target system as well as to 
a telecommunication system to detect a telecommunication fraud. 

FIGURE 1 is an example of a block diagram which illustrates call looping and the 
detection of call looping according to the illustrative embodiment of the present invention. 

1 0 FIGURE 1 shows an originating party (OP) 101 and a terminating party (TP) 103 that are 
interconnected with each other through a network 107, such as a telephone network. The 
exchange carrier puts blocks in the network to protect against a fraudulent call originated 
from the originating party to the terminating party. The blocks attempt to prevent the 
originating party from calling the terminating party. Blocks may be associated with a 

1 5 geographical location of the originating party, and the geographical location of the 

terminating party; a combination of both originating/terminating locations; and/or may be 
switch based. 

Looping is a method which perpetrators, such as hackers, use to circumvent such 
blocks that a telephone service provider puts into the network to control fraudulent 

20 telephone calls. The perpetrators may also use the looping to hide or avoid detection of 
their origination number. Looping may be realized through several types of devices, such 
as a Private Branch Exchanges (PBXs), cellular phones or telephones that are call 
forwarded to an access number. These devices can originate a second call while keeping a 
first call on the line. The call looping perpetrators may loop calls through one carrier, or 

25 they may loop calls through multiple carriers. Looping may take many forms and may use 
different billing products. The end result is to by-pass the block and/or to make difficult to 
identify the origination point. 

As shown in FIGURE 1, in a typical looping transaction, the originating party 101 
places a first call to an intermediate party (IP) 105 in order to circumvent blocks set forth 

30 in the network 107 against fraudulent calls originated from the originating party 101 to the 
terminating party 103. The intermediate party 105 includes a call-origination device, such 
as a private branch exchange (PBX). a cell phone service or a call forwarding telephone. If 
the originating party 101 can access the call-origination device of the intermediate party 
105, the originating party 101 can place a second call on the call origination device to the 

35 terminating party 103 while staying on the first call. 
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The detector 109 provided by the embodiment of the present invention operates on 
the call record data from the network 107 to detect a potential fraudulent call. The call 
record data is substantially generated by normal call processing in the network. Switching 
nodes and other intelligent nodes may generate the call record data. If a first call originates 
5 from the originating party 1 01 to the intermediate party 105, the detector 109 receives a 
terminating number of the first call that is stored in call record database of the network 
107. Additionally, if the second call originates from the intermediate party 105 to the 
terminating party 103, the detector 109 also receives an originating number of the second 
call from call record database in the network 107. The second call is originated within a 
10 predetermined time period from the first call. If the terminating number of the first call is 
identical to the originating number of the second call, the first and the second call may be 
determined to be a fraudulent call. When a fraudulent telephone call is detected in the 
exchange network 107, the detector 109 notifies the exchange network 109 of the 
fraudulent call looping. 

1 5 FIGURE 2 is a block diagram which illustrates an exemplary configuration of the 

network 107 between the originating party and the terminating party shown in FIGURE 1 . 
The network includes a telephone unit 201 of an originating party (OP), a telephone unit 
203 of a local terminating party (TP1), a telephone unit 205 of a long distance terminating 
party (TP2), local exchange carriers (LECs) 21 1 and 213, and an interexchange carrier 

20 (DCC) 212. The originating party and the local terminating party subscribe to a same LEG 
21 1 while the long distance tenninating party subscribes to a different LEC 213. The 
telephone units 201 and 203 of the originating party and the local terminating party are 
connected to switches in the switching office of the LEC 21 1 via transmission lines. 
Similarly, the telephone unit 205 of a long distance terminating party is also connected to a 

25 switch in the switching office of the LEC 213 via transmission lines. The LEC 21 1 and 

LEC 213 are interconnected with each other via an interexchange carrier (IXC) 212, which 
provides long distance service. 

The LEC 21 1 generally routes a local call which originates from the originating 
party to the local terminating party. The local call is routed by one or more switches in the 

30 switching office of LEC 211, which switches or switch the transmission lines which run to 
the telephone units 201 and 203 of the originating party and the local terminating party. In 
addition, the LEC 21 1 routes a call which originates from originating party to a long 
distance terminating party. When the originating party places a long distance call which is 
directed to the terminating party, the call is forwarded to a switch in the switching office of 

35 the originating LEC 21 1 . The originating LEC 21 1 determines which IXC is designated to 
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the call placed on the telephone unit 201 of the originating party, and queries the IXC 212 
whether the IXC 212 can handle the call. The query passes with information about the call, 
such as an originating number, a terminating number and a billing number in order to 
properly route and bill the call. If the IXC 212 can handle the call, the originating LEC 21 1 
5 forwards the call to the IXC 212 with the call information, which is stored in the call 
record database. After determining the availability of the terminating telephone number, 
the IXC 212 forwards the call to the terminating LEG 213, and the call is consequently 
routed to the telephone unit 205 of the long distance terminating party with automatic 
number identification (ANI) information. If the terminating party has a device to decipher 
1 0 the ANI information, the originating number or originating identification can be displayed 
on the screen of a telephone unit in the terminating party. As a result, the originating party 
and the terminating parties are interconnected with each other through the exchange 
network 107. 

FIGURE 3 is an example of a block diagram which illustrates call looping to an 
1 5 international termination. An originating party 301 is geographically located, for example, 
in New York and wishes to place a call to an international destination using a stolen calling 
card. Generally, long distance providers put blocks in their networks to block fraudulent 
calls originating from a large city, such as New York, to international destination in order 
to prevent a revenue loss. Since the long distance carrier may have put blocks in their 
20 network to protect against international termination calls using the stolen calling card 
provided by the long distance provider, the originating party 301 places a domestic 
termination call using the stolen calling card to loop blocks set forth by the long distance 
provider. 

The origination party 301 places the domestic termination call to an intermediate 
25 party 305, such as a business in Iowa, in order to loop around the blocks. The call is 
forwarded to the switching office of the originating LEC 31 1 in New York. After 
examining the designated IXC 312 to handle the first call, the originating LEC 31 1 in New 
York forwards the first call to the IXC 312. Call information, including an originating 
number, a termination number, and a billed number, is forwarded along with the call. The 
30 call information is contained in one or more call records which are stored in the call record 
database. After the IXC 3 1 2 determines the availability of proper lines and switches to the 
intermediate party 305. the IXC 3 1 2 forward the call to a terminating LEC 3 15 in Iowa. 
The terminating LEC 315 completes the first call by connecting the first call to the 
intermediate party 305. 
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If the business in Iowa, the intermediate party 305, includes a call origination 
device (such a PBX equipment, a cell phone or a call forwarding telephone) the originating 
party 301 can loop the first call to a desired destination via the call origination device at the 
intermediate party 305. In particular, the originating party 301 places a second call to an 
international termination using the call origination device. Assuming that the call 
origination device is a private branch exchange (PBX), the PBX switches and routes calls 
internally, routes calls externally and provides a dial tone to the internal users of the 
intermediate party 305. If the originating party 301 can access the PBX system of the 
intermediate party 305, the originating party 301 is able to dial 9 for external termination 
of the PBX. If the originating party 301 dials 00 for the long distance operator, the 
originating party 301 can make a call to an international termination. In this case, the 
second call (i.e. the international call) is billed to the number from which the second call 
originates (i.e. the number of the PBX at the intermediate party 305). 

The individual skilled in the art will appreciate that the call origination device need 
1 5 not be a PBX equipment, a cell phone or a call forwarding telephone; rather the device can 
be any device which can grab the originating party from the first call and keep the 
originating party of the first call as an originating party 301 for a second call originating 
from the device. 

The second call originates from the call origination device of the intermediate party 

20 305 and is forwarded to the intermediate LEC 315 in Iowa. Since the IXC 312 has fewer 
blocks on the originaung location of Iowa for international termination calls, this second 
call has a higher probability of success than a fraudulent call originated from New York. 
After the examination, the LEC 315 in Iowa forwards the second call to the IXC 312 with 
call information, including originating number, terminating number and billed number, 

25 which are stored in the call record database as shown in FIGURE 3. The IXC 312 receives 
a second call from LEC 315 in Iowa and determines that the proper lines and switches are 
available along the call path to the terminating telephone number. After the determination, 
the IXC 312 forwards the call with terminating telephone number to the foreign exchange 
carrier 313, which routes the second call to a foreign party 303. 

30 FGURE 4 is an example of call record data which is used in the embodiment of the 

present invention. The exchange network creates call record data for each call and the call 
record data is stored in a storage element of the network. The call record data generally 
includes date 401 and time 403 at which the call originates. In particular, the call record 
data includes a billed number 405, an originating number 407 and a terminating number 

35 409. The billed number 405 is the account number charged for the telephone call. The 
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billed number 405 may include a calling card number, credit card number, originating 
telephone number, terminating telephone number, etc. In normal residential dialing, the 
originating telephone number is identical to the billed number such as in call record No. 4 
of FIGURE 3. The illustrative call record data in FIGURE 4 shows several phone calls 
5 over a short period of time. Call record No. 2 shows a call originated from an originating 
party at 212-210-9182, to an intermediate party at 515-565-5500. To illustrate the 
operation of the illustrative embodiment, suppose that the associated phone call constitutes 
the initial leg of a call looping transaction that is fraudulent. The first call is billed to 
billing number, 21345839485900, which for illustrative purposes, is presumed to be the 

1 0 number of a stolen calling card. Call record No. 4 shows that a call originated from the 

intermediate party at 515-565-5500, to a foreign party at 86-591-1938-4944. This call is an 
example of the second leg of a call looping transaction. The second call is billed to the 
intermediate party at 51 5-565-5500, and the originating party can make a call of 
international terrninauon without being billed. The illustrative embodiment processes this 

1 5 call record data as described in more detail below to identify the call looping transaction 
and to prevent any further international calls originating from the intermediate party. 

FIGURE 5 is a block diagram that illustrates components of the detector 1 09 in 
more detail. The fraudulent call detector 109 detects fraudulent calls that are part of caU 
looping transaction based on a call origination at a intermediate party. The call looping 

20 detector includes receiving buffers 501 and 503, a timer 505, a comparator 507 and an 

alarm 509. As described above, the exchange network generates call record data for each 
call and stores the generated call record data in a storage element. The buffers 501 and 503 
receive the call record data from the storage element in the network. The terminating 
buffer 503 receives a terminating number of a first call originated from an originating party 

25 to an intermediate party. The originating buffer 503 also receive the originating number of 
a second call originated from the intermediate party to a terminating party. The timer 505 
is used to calculate a time period from the first call to the second calls which are taken into 
account. The timer 505 sets forth a tolerance of a time difference between the first call and 
the second call. Generally, in call looping, the origination of the second call is made 

30 substantially at the same time of the termination of the first call. A comparator 507 

compares the terminating number of a first call with the originating number of second calls 
which are originated within a time period set forth by the timer 505. If the terminating 
number of the first call is identical to the originating number of second calls which are 
originated within the time period set forth by the timer 505, the alarm 509 triggers a 

35 notification of an occurrence of a fraudulent telephone call to the exchange network. 
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Referring back to FIGURE 4, if the timer is set to two minutes and call record No. 
2 is received as information of a first call, call record No. 3 and No.4 fall within the time 
period (i.e. two minutes). The terminating number 41 1 of the call shown at call record No. 
2 is identical to the originating number 4 1 3 of the call shown at call record No. 4. 
5 According to the exemplary embodiment of the present invention shown in FIGURE 5, the 
calls shown at call record No. 2 and No. 4 correspond to call looping and, therefore, the 
alarm 509 signifies the occurrence of a potentially fraudulent call. 

FIGURE 6 is an example of a block diagram which illustrates an alternative 
implementation of the fraudulent call detector 109. In FIGURE, the fraudulent call detector 

10 109 also includes receiving buffers 601 and 603, a timer 605, a comparator 607, and an 
alarm 609. This implementation additionally includes a database 6 1 1 for storing telephone 
numbers which are exempted from the result of the embodiment shown in FIGURE 5. In 
this case, the comparator 608 further compares the terminating number of a first call and 
the originating number of a second call with the telephone numbers stored in the exempted 

1 5 number database 611. Those of skill in the art will appreciate that the comparators 607 and 
608 can be implemented in a processor 606 of a computer system. The alarm 609 notifies a 
fraudulent call only if the detected telephone number is not included in the exempted 
number database 61 1, even though the terminating number of the first call is identical to 
the originating number of second calls which are originated within the time period set forth 

20 by the timer 605. The exempted number database 611 is provided to prevent the calls 
placed by the legitimate customer from being determined as a fraudulent call pattern. 
Those skilled in the art will appreciate that the exempted number database may include a 
plurality of telephone numbers for legitimate use. For example, the exempted number 
database may include 1-8XX telephone numbers. 

25 FIGURE 7 is an example of a block diagram which illustrates another alternative 

. implementation of fraudulent call detector 1 09. In FIGURES 7, the fraudulent call-detector 
also includes receiving buffers 701 and 703, a timer 705, comparators 707 and 708, an 
alarm 709 and an exempted number database 711. A storage element 713 is provided for 
storing a newly detected fraudulent telephone numbers. If the comparator 708 detects a 

30 fraudulent telephone call which is not exempted from a fraudulent call pattern, the detected 
telephone numbers are stored in the detected number database 713. The comparator 714 of 
the present embodiment, therefore, further compares the terminating number of the first 
call and the originating number of the second call with the previously detected fraudulent 
telephone numbers stored in the detected number database 713. If the comparator 714 find 

35 that the terminating number of the first call and the originating number of the second call 
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are identical to the previously detected fraudulent telephone numbers stored in the detected 
number database 713, a blocking unit 715 puts blocks on the second call to prevent a 
fraudulent call from completing a desired call. As a result, this embodiment of the present 
invention has the effect of providing a real time reaction to prevent a fraudulent call from 
5 completing. Those of skill in the art will appreciate that the comparators 707, 708 and 7 1 4 
can be implemented in a processor 706 of a computer system. 

FIGURE 8 is a flowchart of the steps performed in the illustrative embodiment of 
the present invention to detect a fraudulent telephone call. As described above, the 
exchange network generates call record data for each call and stores the generated data in a 

1 0 storage element. The detection method operates on the call record data. The first step is 
therefore, to provide the call record data (step 801). A terminating number of a first call 
originated from an originating party to an intermediate party is extracted from the call 
record data (step 803). Subsequently, the originating number of a second call originated 
from the intermediate party to a terminating party is extracted (step 805). The terminating 

1 5 number of the first call is then compared with the originating number of the second call 
which originated within a predetermined time period from the first call (step 807). 
Generally, the second call is originated substantially at the same time of a termination of 
the first call. If the. terminating number of the first call and the originating number of the 
second call arc the same, the illustrative embodiment concludes that a fraudulent call may 

20 have been placed. 

FIGURE 9 is a flowchart of steps performed by the extensions of the illustrative 
embodiment that is depicted in FIGURES 6 and 7. This embodiment additionally includes 
the step of comparing the terminating number of the first call and the originating number 
of the second call with the exemption telephone numbers stored in the exempted number 

25 database (see FIGURE 6), and the step of comparing the terminating number of the first 
call and the originating number of the second call with the previously detected fraudulent 
call numbers stored in the detected number database (see FIGURE 7). 

Where the originating number and the terminating number are the same and the 
associated calls are placed within the specified time limits, several steps are taken. First, 

30 the phone numbers involved in previous fraudulent transactions are loaded from the 
detected number database (step 901). The terminating number of the first call and the 
originating number of the second call which are originated within a time period are 
compared with the loaded numbers (step 903). If the terminating number of the first call 
and the originating number of the second call match the previously detected fraudulent 
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telephone numbers stored in the de tected number database, blocks are implemented to 
block the second call (step 913), and an alarm is sent to the network (step 911). 

As mentioned above, exemption numbers may be referred. In order to use the 
exemption numbers, the exemption telephone numbers must be loaded from the exempted 
5 number database (step 905). The terminating number of the first call and the originating 
number of the second call are then compared with the exemption numbers (step 907). If the 
terminating number of the first call and the originating number of the second call match the 
exemption numbers, the embodiment of the present invention goes to the ending step, 
which means that no fraudulent call patterns are found. Otherwise, the terminating number 

1 0 of the first call which is identical to the originating number of the second call is stored in 
the detected number database to be compared in the next process (step 909). If a fraudulent 
call is found, the embodiment of the present invention alarms a fraudulent telephone call to 
a exchange network (step 91 1). 

It is apparent that there has been provided, in accordance with the present 

1 5 invention, a method and system for detecting and preventing a fraudulent call based on the 
call record data. While this invention has been described in conjunction with illustrative 
embodiments thereof, it is evident that many alternatives, modifications, and variations 
will be apparent to those skilled in the art. For example, the present invention can be 
applied to a security monitoring system to detect an unauthorized access to the target 

20 system as well as to a telecommunication system to detect a telecommunication fraud. 
Accordingly, it is intended to embrace all such alternatives, modifications and variations 
that fall within the spirit and broad scope of the appended claims. 
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Claims 

1 l . In a telecommunication system, a method for detecting and preventing a fraudulent 

2 telephone call, said method comprising the steps of: 

3 providing call record data including an originating number and a terminating 

4 number of each call; 

5 extracting call record data of a first call and a' second call, said second call 
G originating within a predetermined time period from a termination of the first call; 

7 comparing the terminating number of the first call and the originating number of 

8 the second call; and 

9 determining a fraudulent telephone call pattern based on the comparison of said 
1 0 comparing step. 

11 

1 2. The method of claim 1 further comprising a step of notifying an occurrence of a 

2 fraudulent telephone call. 
3 

1 3. The method of claim 1 wherein said first call is a domestic long distance call. 
2 

1 4. The method of claim 1 wherein said second call is placed to international 

2 termination. 
3 

1 5. The method of claim 1 wherein the second call is originated substantially at the 

2 same time of a termination of the first call. 
3 

1 6. The method of claim 1 wherein said step of determining a fraudulent call comprises 

2 the step of comparing the terminating number of said first call and said originating pumber 

3 of said second call with exemption telephone numbers previously stored in a storage 

4 element. 
5 

1 7. The method of claim 6 wherein said exemption telephone numbers includes 1 -8XX 

2 number. 
3 

1 8. The method of claim 1 further comprising the step of storing a newly detected 

2 fraudulent telephone numbers in a storage element. 
3 
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19. The method of claim 8 wherein said comparing step further comprises the step of 
2 comparing the terminating number of the first call and the originating number of the 
second call with previously detected fraudulent telephone numbers stored in a storage 



3 



4 element. 
5 

1 10. The method of claim 9 further comprising the step of blocking the second call. 



2 
1 



U. In a computer system, a device for detecting and preventing a fraudulent telephone 

2 call, said device comprising: 

3 a storage element for providing a terminating number of a first call and an 

4 originating number of a second call; 

5 a timer for calculating a predetermined time period from said first call; 

6 a processor for comparing said terminating number of said first call with said 

7 originating number of said second call originated within a predetermined time set forth by 

8 said timer. 
9 

1 1 2. The device of claim 1 1 further comprising an alarm for notifying a fraudulent 

2 telephone call based on said comparison of said terminating number of said first call with 

3 said originating number of said second call. 
4 

1 13. The device of claim 1 1 further comprising a second storage element for storing a 

2 database of telephone numbers which are exempted from a fraudulent telephone call 

3 pattern. 
4 

1 14. The device of claim 1 3 wherein said processor further comprises a means for 

2 comparing said exemption numbers with said terminating number of said first call, and said 

3 originating number of said second call. 
4 

1 15. The device of claim 1 1 further comprising a third storage element storing phone 

2 numbers of a newly detected fraudulent call pattern. 



1 16. The device of claim 15 wherein said processor further comprises a means for 

2 comparing said terminating number of said first call and said originating number of said 

3 second call with previously detected fraudulent telephone numbers stored in said third 

4 storage element. 



5 
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1 1 8. The device of claim 1 6 further comprising: 

2 a mechanism for blocking the second call based on the comparison of said first call 

3 and said originating number of said second call with previously detected fraudulent 

4 telephone numbers stored in said third storage element. 

1 19. A computer pro gram product for controlling a computer to enhance a resolution of 

2 compressed image data, said program product comprising: 

3 a recording medium readable by the computer 

4 means recorded on said recording means for generating a terminating number of a 

5 first call; 

6 means recorded on said recording means for calculating a predetermined time 

7 period from said first call; 

8 means recorded on said recording means for generating an originating number of a 

9 second call originated within the time period; 

1 0 means recorded on said recording means for comparing said terminating number of 

U said first call with said originating number of said second call; and 

1 2 means recorded on said recording means for alarming a fraudulent telephone call 

13 based on said comparison of said terminating number of said first call with said originating 

14 number of said second call. 
15 
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